Make Attestation fields nullable to match TU API spec; add CI

[oojacoboo]

Summary

• Production bug fix: Per the TransUnion ShareAble v3 OpenAPI spec, Attestation.name, Attestation.legalText, and Attestation.additionalInformation are all nullable. Our DTO had them as non-nullable string (with Assert\NotBlank on name/legalText), so any attestation with a null/missing field from TU would throw TypeError during deserialization.
• Defensive guards: AttestationGroup::fromArray now tolerates missing or null attestations keys, and AttestationGroup::toArray no longer iterates over null arrays.
• CI workflow: New .github/workflows/ci.yml runs phpunit --testsuite unit on every push/PR against master. Switches the coding-standard-php repository URL to HTTPS so the workflow can install dev deps without SSH auth (the package is now public).

Test plan

• vendor/bin/phpunit --testsuite unit — 66 tests pass (10 new across AttestationTest + new AttestationGroupTest)
• New tests cover: null name/legalText/additionalInformation, missing attestations key in fromArray, null attestations value, empty toArray, false-affirmative responses
• Verify CI workflow runs green once this PR is open

Related

• Pairs with the api repo's hotfix/attestation-affirmative-required branch which fixes the manager-facing UI that hardcoded true for every attestation response